OSA RFP Financial Audit Lottery 1-12-18.pdf

COLORADO OFFICE

````` OF THE STATE

AUDITOR

A REQUEST FOR PROPOSAL

FINANCIAL AND COMPLIANCE AUDIT

DEPARTMENT OF REVENUE, STATE LOTTERY

DIVISION

FISCAL YEAR ENDED JUNE 30, 2018

JANUARY 12, 2018

TABLE OF CONTENTS

SECTION I: Administrative Information

SECTION II: Information to Be Included in Proposal

SECTION III: Proposal Evaluation Process

SECTION IV: Supplemental Information

SECTION I

ADMINISTRATIVE INFORMATION

A. ISSUING OFFICE

This request for proposal (RFP) is issued by the Office of the Colorado State Auditor. The terms State Auditor, State, and State of Colorado are used interchangeably. All proposals should be delivered to:

Office of the Colorado State Auditor

State Services Building 1525 Sherman St, 7th Floor Denver, Colorado 80203

Attn: Bryan Brune bryan.brune@state.co.us

As an agency within the Legislative Branch, the OSA and this solicitation are exempt from the State Procurement Code and State Procurement Rules. All communications regarding this RFP should take place directly with the OSA’s assigned contact listed above.

B. BACKGROUND INFORMATION

The Office of the State Auditor (OSA) is soliciting proposals to conduct an audit of the Department of Revenue, State Lottery Division. The State Lottery Division was created as a Division within the Department of Revenue with the passage of Senate Bill 119 on April 30, 1982. The Lottery began operations on July 1, 1982 and sold its first lottery ticket on January 24, 1983.

The Lottery is governed by a Commission of five members appointed by the Governor. By statute, lottery commission members must include an attorney, a certified public accountant, and a law enforcement officer. Members may serve up to two 4-year terms. The commission’s responsibilities are stated in Section 24-35-208, C.R.S., and include:

• Promulgation of rules and regulations to govern Lottery operation.

• Carrying on a continuous study and investigation of the Lottery to determine the need for changes in statutes, rules or regulations, or in the administration and operation of the Lottery.

The Lottery’s enabling legislation requires that no less than 50 percent of the total revenue from sales of lottery tickets be for prizes. The legislation also provides guidelines for distribution of net proceeds to beneficiary agencies.

The Colorado Lottery currently contracts with a third party vendor for comprehensive jackpot and scratch ticket gaming products and services. Pursuant to this contract, a third party vendor has implemented and operates for the Lottery an extensive computerized wagering system, including primary and back-up central computer systems, communications equipment and retailer sales terminals used for the Lottery’s Powerball, Mega Millions, Lucky for Life, Lotto, Pick 3, and Cash 5 games and game ticket validations. A third party vendor system processes a very large portion of the Lottery’s financial data, including all daily sales data for the Powerball, Lotto, Cash 5 on-line games and scratch games.

The Department of Revenue, State Lottery Division was appropriated $98,320,468 total funds and

117.1 FTE in Fiscal Year 2018.

C. SERVICES REQUIRED

The purpose of this RFP is to solicit proposals to perform a financial and compliance audit of the Department of Revenue, State Lottery Division for the fiscal year ending June 30, 2018. The financial and compliance audit is to be performed in accordance with accounting and auditing standards described in subsection P below.

Audit work to be performed for the fiscal year ending June 30, 2018 consists of the following:

1.

a) Audit of the basic financial statements of the Division for the year ended June 30, 2018, including a review of the related internal control structure as required by generally accepted auditing standards and Government Auditing Standards.

This includes the identification and performance of appropriate information technology general control testing of the Division’s key information technology systems, in accordance with auditing standards. Appropriate testing includes evaluating the design and operating effectiveness of the key information technology general controls within relevant systems, including any system interfaces, that are critical components of the financial reporting processes and which could significantly impact the financial statements.

b) Review of the Division’s compliance with state and federal laws and regulations, State Fiscal Rules, and bond covenants that could have a material effect on the Division’s financial statements.

c) Performance of audit work to evaluate the Division’s progress in implementing prior audit recommendations.

d) Review of exhibits required by the State Controller to be submitted to the State Controller in support of the statewide financial statements. Also, review of all of the Division’s adjusting entries, posted or not, after the Colorado Operations Resource Engine’s (CORE’s) final year-end closing.

e) Submission of attestation memos to the Office of the State Auditor on the results of audit work performed. These memos will be used to support the audit of the statewide financial statements and statewide Single Audit.

Attestation memo templates required for the Fiscal Year 2017 audit are included in Section IV, Supplemental Information, for reference purposes. The attestation memos for Fiscal Year 2018 will be provided at a later date.

f) Preparation of report comments and/or a management letter, as appropriate based on assessed severity level, containing audit findings and recommendations for improvements in the operations, internal controls, and accounting procedures of the Division, along with any opportunities for cost savings determined through the audit. This will include obtaining and reviewing responses to the recommendations from the Division’s management and ensuring they meet the State’s established parameters for responses. In accordance with Government Auditing Standards, for any “Partially Agree” or “Disagree” response, the contractor shall prepare an Auditor’s Addendum as a rebuttal to the Audited Agency’s response. All report comments, management letters, responses, and Auditor’s Addenda must be reviewed and approved by the OSA.

Such audit work will result in the issuance of the following:

g) Independent auditors’ report on the financial statements of the Department of Revenue, Division of Lottery as of and for the year ended June 30, 2018.

h) Independent auditors’ report on internal control over financial reporting and on compliance and other matters based on an audit of the financial statements of the Department of Revenue, Division of Lottery performed in accordance with Government Auditing Standards for the year ended June 30, 2018.

D. ORAL PRESENTATION

The contractor may be required to testify for about one hour before the Legislative Audit Committee and one other legislative committee. This testimony will be an oral summary of the written report with questions by Committee members and verbal responses from the contractor and from the Department of Revenue, State Lottery Division. In addition, the contractor is expected to provide oral presentations to the Department of Revenue, State Lottery Division at the commencement and conclusion of the audit, which are the entrance and exit conferences. Various other meetings with State Auditor and Department of

Revenue, State Lottery Division personnel will be required to communicate requirements, expectations, issues, and results, to ensure a smooth and timely completion.

E. INQUIRIES SECTION

Prospective bidders may make written inquiries concerning this RFP to obtain clarification of requirements. Please address all inquiries to Bryan Brune, Legislative Audit Supervisor, bryan.brune@state.co.us, 303-869-3060 (fax). No inquiries will be accepted after 5:00 p.m. MT on January 24, 2018.

F. SUBMISSION

All proposals become the property of the State Auditor upon receipt and will not be returned to the bidder. The State Auditor shall have the right to use all ideas, or adaptations of these ideas, contained in any proposal received in response to this RFP. Selection or rejection of the proposal will not affect this right.

All proposals are subject to the Colorado Open Records Act (Sections 24-72-200.1 through 206, C.R.S.). If any part of the proposal contains proprietary information, such information shall be clearly identified in the proposal.

G. ACCEPTANCE OF PROPOSAL

This RFP does not commit the State Auditor to award a contract, to pay any costs incurred in the preparation of a bid submitted in response to this request, or to procure or contract for services or supplies. The State Auditor reserves the right to accept or reject, in part or in its entirety, any or all bids received as a result of this RFP if, in the opinion of the State Auditor, it is in the best interest of the State to do so. The lowest cost proposal will not necessarily be selected. Final scope and price may be negotiated after selection of the contractor.

H. PROPOSALS - SCHEDULE

The following schedule will be followed:

1. RFP available to prospective bidders

2. Prospective bidder's inquiry deadline

3. OSA response to inquiry deadline

4. Proposal submission deadline (5:00 PM MT)

5. Approximate bid selection

6. Approximate contract date

Friday, January 12, 2018 Wednesday, January 24, 2018

Monday, February 5, 2018 Tuesday, February 20, 2018

Monday, March 5, 2018 Monday, March 19, 2018 mailto:bryan.brune@state.co.us

Any proposal received after the submission deadline will not be considered. The proposal is to be submitted to the State Auditor via email addressed to the Office of the State Auditor representative listed in Section I, Part E. The proposal must be sent by a person legally authorized to bind the bidder. Optionally, five (5) bound copies may be submitted, signed by a person legally authorized to bind the bidder.

I. ADDENDUM OR SUPPLEMENT TO REQUEST FOR PROPOSAL

The State Auditor reserves the right to issue amendments to this RFP prior to the closing date for submission of proposals. In the event that it becomes necessary to revise any part of this RFP, an addendum to this RFP will be provided to each prospective bidder.

J. AWARD WITHOUT DISCUSSION

The State Auditor reserves the right to make an award without further discussion of proposals received. Therefore, it is important that the proposal be submitted in the most complete terms possible from both the technical and cost standpoint.

K. AWARD INFORMATION TO UNSUCCESSFUL FIRMS

The State Auditor will notify all unsuccessful bidders after the award. No information will be released after the proposal submission deadline until an award has been made.

L. JOINT VENTURES

No joint venture proposals will be accepted. However, this requirement does not preclude the use of outside special consultants if deemed necessary by the firm.

M. OTHER WORK PERFORMED FOR THE DEPARTMENT OF REVENUE, STATE

LOTTERY DIVISION

In its proposal, the firm should describe any work performed for the Department of Revenue, State Lottery Division within the past two years, and why this work would not impair the firm’s independence in performing the Fiscal Year 2018 financial and compliance audit of the Department of Revenue, State Lottery Division.

N. ELIGIBLE FIRMS

Any firm providing financial and compliance audit services for Department of Revenue, State Lottery Division under contract with the State Auditor in previous years may bid on this contract providing that the lead partner, under the proposal, has not performed audit services beyond a total maximum of five years in a 10-year period.

O. STATE AUDITOR LIAISON

The State Auditor will designate an individual from her office to be a liaison to the firm throughout the audit. This individual will attend entrance/exit conferences and assist the firm to understand State Auditor requirements and reporting guidelines.

P. GENERAL INFORMATION

1. Audit Standards

a. The audit shall be performed in accordance with generally accepted auditing standards as promulgated by the American Institute of Certified Public Accountants in Statements on Auditing Standards, the standards for financial and compliance audits contained in Government Auditing Standards – 2011 Revision issued by the Comptroller General of the United States, the Single Audit Act as amended, the Provisions of Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (federal uniform grant guidance), the AICPA Audits of State and Local Governmental Units and Government Auditing Standards and Single Audits audit and accounting guides, and Fiscal Rules promulgated by the State Controller.

2. Prior Audits

The Department of Revenue, State Lottery Division’s audit report for the fiscal year ended June 30, 2017 (Report No. 1720F) and audit reports for years prior to that are available at our web site at:

http://leg.colorado.gov/audits/colorado-lottery-fiscal-years-june-30-2017-and-

3. Timing Considerations

The general control testing over the key information technology systems, and corresponding draft report findings and recommendations, must be completed by May 31, 2018.

http://leg.colorado.gov/audits/colorado-lottery-fiscal-years-june-30-2017-and-2016 http://leg.colorado.gov/audits/colorado-lottery-fiscal-years-june-30-2017-and-2016

All non-IT internal control and compliance audit work, and corresponding draft report findings and recommendations, must be completed by July 31, 2018.

The major programs for the Single Audit Act for the Department of Revenue, State Lottery Division are determined by the Office of the State Auditor at the statewide level. For Fiscal Year 2018, it is anticipated that the Division will not have any major programs for audit.

The Department of Revenue, State Lottery Division’s TABOR enterprise status and revenue testing must be completed by August 24, 2018. The Division’s prior year’s audit recommendations must be tested and auditor’s dispositions determined by September 4, 2018.

Proposed audit adjustments and their effect on the Division's financial statements should be provided to the State Auditor by October 12, 2018. A draft report should be completed by about October 1, 2018. The final audit report must be delivered to the State Auditor by October 31, 2018.

4. Audit Contract Period

The firm selected will be awarded a one-year contract which may be renewed on an annual basis for up to four additional years subject to acceptable performance and costs.

Q. AWARD OF BID

The contract will be awarded to that bidder whose proposal will be most advantageous to the State of Colorado, price and other factors considered. The successful bidder is expected to execute and adhere to the terms and conditions in the OSA’s standard contract and its related exhibits. A copy of the OSA’s standard contract and its related exhibits is included in Section IV - Supplemental Information of this RFP.

R. SUBMISSION OF INVOICES

The contractor may submit monthly invoices for audit work completed. The State Auditor reserves the right to withhold 10 percent of the total contract amount pending satisfactory completion of the audit.

SECTION II

INFORMATION TO BE INCLUDED IN PROPOSAL

All proposals must include the information requested in this section and be organized in the same manner as this section.

All proposals submitted to the OSA in response to this RFP are subject to the Colorado Open Records Act (CORA). Any proprietary information your firm includes in the proposal should be clearly and specifically designated in the proposal. Such information will be redacted from the proposal pursuant to 24-72-204(3)(a)(IV), C.R.S., allowing for the denial of inspection of records including trade secrets, before providing the proposal in response to a CORA request.

A. TITLE PAGE

The proposal will identify the RFP subject, firm name, local address, telephone number, name of contact person, and the date.

B. TABLE OF CONTENTS

The proposal will include a clear identification of the material included in the bid proposal by section and by page number.

C. TRANSMITTAL LETTER

Please limit the transmittal letter to two or three pages. Provide the names of individuals authorized to make representations for the firm and their titles, addresses and telephone numbers.

D. PROFILE OF THE FIRM

The proposal must:

1. State whether the firm is local, national, or international.

2. Give the location of the office from which the work is to be done and number of partners, shareholders, and managers and other professional staff employed at that office.

3. Describe the range of activities performed by the local office.

4. Describe the local office's capability, including the numbers and classifications of personnel who will work on the audit.

5. Affirm that the firm is a properly licensed certified public accounting firm authorized to practice in the State of Colorado.

6. Affirm that the firm has participated in a quality control review within the past three years. A copy of the review must be included in the proposal.

7. Affirm that the firm does not have any past history of substandard work.

8. Affirm that the firm is independent for this audit engagement. Describe any work performed by the firm for the Department of Revenue, State Lottery Division within the past two years and explain the firm’s independence.

9. Provide information on any past, current or anticipated claims (i.e., knowledge of pending claims) on respondent contracts; explain the litigation, the issue, and its outcome or anticipated outcome.

E. QUALIFICATIONS OF ASSIGNED PERSONNEL

The proposal must identify the principal staff (i.e., partners/principals, managers, and supervisors/in-charges) who will work on the audit, including personnel not from the local office and any specialists or subcontractors to be used. The proposal must include a resume of all principal staff highlighting their professional qualifications and similar audit work that they have performed (resumes should be included in an appendix).

F. FIRM'S APPROACH TO THE AUDIT

The proposal must include a general description of the methodology, approach, tools, and resources to be used to conduct the audit.

G. COMPENSATION

1. The proposal must state the number of professional staff hours estimated to complete the audit work by staff level, the hourly rate, and the resulting total cost.

The bidder is advised that travel costs incurred in the performance of audits are reimbursable only as a part of the hourly rate and must be covered under said rate and will not be separately reimbursed.

2. The proposal must state the total inclusive maximum fee for which the work requested will be done, excluding audit work for any federal major programs. The fees for this audit work will be added to the base price. The anticipated fee for the audit of a federal major program for Fiscal Year 2018 is $7,650.

3. The proposal should affirm that all prices, terms, and conditions will be held firm for at least 90 days after the bid opening.

H. DELIVERY SCHEDULE

The proposal must include a schedule of the audit work to be performed and delivery date of the required reports.

I. ADDITIONAL DATA

Since the preceding sections are to contain information that is specifically requested, the firm may include any additional information considered essential to the proposal in this section. The firm should not include general information publications, such as directories or client lists.

SECTION III

PROPOSAL EVALUATION PROCESS

A. GENERAL

An evaluation team will judge the merits of proposals received in accordance with the general criteria defined below. The bidder is responsible for providing all information requested in this RFP, and failure to do so may result in disqualification of the proposal.

The evaluation committee will select the bidder whose proposal is most responsive to the State Auditor's needs while being within available resources. The specifications within this RFP represent the minimum performance necessary for response.

During the evaluation process, the evaluation committee may, at its discretion, request any one or all firms to make oral presentations or answer questions about their proposals. Not all firms may be asked to make such oral presentations.

B. MANDATORY CRITERIA

1. The firm must be licensed to practice as a certified public accounting firm in the State of Colorado.

2. The firm must have had a quality control review completed within the past three years. A copy of the review must be included in the proposal.

3. The firm is independent for the audit engagement.

C. GENERAL CRITERIA

1. Adequacy and completeness of the proposal with regard to the information specified in the RFP.

2. Breadth and depth of applicable experience.

3. Sufficient size organization to adequately staff audit.

4. Proposed costs (fees and hours).

5. Comprehensiveness and appropriateness of work plan.

D. TOTAL SCORE

The evaluation team will assign scores to the proposals based on the established criteria.

The State Auditor will make the final decision on the contract award.

SECTION IV

SUPPLEMENTAL INFORMATION

Enclosed with this RFP are the following:

1. Standard OSA contract and related exhibits. The successful bidder is expected to execute and adhere to the terms and conditions in the OSA’s standard contract and its related exhibits.

2. Statewide Attestation memos to be submitted to the Office of the State Auditor statewide audit team applicable for the prior fiscal year audit.

Routing # 2018-XX

STATE OF COLORADO

State Auditor and

Legislative Audit Committee Financial Audit Contract for the

Audit of the INSERT NAME OF ENTITY With

INSERT NAME OF CONTRACTOR

TABLE OF CONTENTS

1. PARTIES

2. EFFECTIVE DATE AND NOTICE OF NONLIABILITY

3. RECITALS

4. DEFINITIONS

5. TERM and EARLY TERMINATION

6. STATEMENT OF WORK

7. PAYMENTS TO CONTRACTOR

8. REPORTING - NOTIFICATION

9. CONTRACTOR RECORDS

10. WORK PRODUCT - CONFIDENTIAL INFORMATION-STATE RECORDS

11. CONFLICTS OF INTEREST

12. REPRESENTATIONS AND WARRANTIES

13. INSURANCE

14. DISPUTE RESOLUTION

15. BREACH

16. REMEDIES

17. NOTICES and REPRESENTATIVES

18. RIGHTS IN DATA, DOCUMENTS, AND COMPUTER SOFTWARE

19. GOVERNMENTAL IMMUNITY

20. GENERAL PROVISIONS

21. COLORADO SPECIAL PROVISIONS

22. SIGNATURE PAGE

23. EXHIBIT A - STATEMENT OF WORK ............................................................................................ Exhibit A-i

24. EXHIBIT B - REQUEST FOR PROPOSAL ....................................................................................... Exhibit B-i

25. EXHIBIT C - MODIFICATIONS TO CONTRACTOR’S PROPOSAL............................................. Exhibit C-i

26. EXHIBIT D - CONTRACTOR’S PROPOSAL ................................................................................... Exhibit D-i

27. EXHIBIT E - INFORMATION SECURITY POLICY FOR CONTRACTORS ................................ Exhibit E-i

28. EXHIBIT F - COMPENSATION AND PROCEDURES FOR BILLING .......................................... Exhibit F-i

29. EXHIBIT G - DEVELOPING AND PRESENTING AUDIT FINDINGS .......................................... Exhibit G-i

30. EXHIBIT H - REPORTING REQUIREMENTS AND FORMAT FOR

SEPARATELY ISSUED REPORT .............................................................................. Exhibit H-i

31. EXHIBIT I - REPORTING FOR STATEWIDE FINANCIAL STATEMENTS

AND SINGLE AUDIT ................................................................................................... Exhibit I-i

1. PARTIES

This Contract is entered into by and between ___________ (“Contractor”), and the STATE OF COLORADO (the "State") acting by and through and for the use and benefit of the State Auditor and the Legislative Audit Committee . Contractor and the State agree to the terms and conditions specified in this contract.

2. EFFECTIVE DATE AND NOTICE OF NONLIABILITY

The Effective Date of this Contract is the date on which this Contract has been approved and signed by all of the Parties, including on behalf of the State the State Auditor or the State Audiutor's designee and the Chair of the Legislative Audit Committee, and, after legal review, by the Director of the Office of Legislative Legal Services or the Director's designee. This Contract is not effective or enforceable before the Effective Date, and the State is not liable to pay or reimburse Contractor for any Work performed or costs or expenses incurred by the Contractor before the Effective Date or after the expiration or other termination of this Contract.

3. RECITALS

A. Authority, Appropriation, And Approval

Authority to enter into this Contract exists in CRS §2-3-103(1), funds have been budgeted, appropriated and otherwise made available pursuant to Fund 1000, Appropriation Code MGFCC4010, Contract Encumbrance Number 2018-XX, and a sufficient unencumbered balance of the funds remains available for payment. Required approvals, clearance, and coordination have been accomplished from and with appropriate agencies.

B. Consideration The Parties acknowledge that the mutual promises and covenants contained in this Contract, including the Exhibits attached to and incorporated by reference in this Contract.are sufficient and adequate to support this Contract.

C. Purpose The State is engaging Contractor to render professional auditing services as specified in this Contract, including the Exhibits attached to and incorporated by reference into this Contract.

D. References All references in this Contract to sections (whether spelled out or using the § symbol), subsections, exhibits or other attachments, are references to sections, subsections, exhibits, or other attachments contained in this Contract or incorporated by reference into this Contract unless otherwise noted.

4. DEFINITIONS

The following terms shall be construed and interpreted as follows:

A. Audit Report

“Audit Report” means the standard report on the audit of the Audited Agency’s financial statements and the related report on internal control over financial reporting and compliance.

B. Audited Agency “Audited Agency” means the Insert Name of Entity.

C. Business Day "Business Day" means any day on which the State is open and conducting business, but does not include Saturday, Sunday, or any day on which the State observes a legal holiday listed in section 24-11-101 (1), C.R.S.

D. CJI

"CJI" means criminal justice information collected by criminal justice agencies needed for the performance of their authorized functions, including, without limitation, all information defined as criminal justice information by the U.S. Department of Justice, Federal Bureau of

Investigation, Criminal Justice Information Services Security Policy and all criminal justice records, as defined in §24-72-302, C.R.S.

E. Contract “Contract” means this Contract, including the Exhibits attached to and incorporated by reference into this Contract, any other documents incorporated by reference into this Contract, and any amendments to this Contract or additional Exhibits, or other documents incorporated into this Contract after the Effective Date.

F. Contract Funds “Contract Funds” means the maximum amount of funds available for payment by the State to Contractor pursuant to section 7.A. of this Contract.

G. CORA

"CORA" means the "Colorado Open Records Act", §§ 24-72-200.1, et. seq, C.R.S.

H. Effective Date "Effective Date" means the date on which this Contract has been approved and signed by all of the Parties and, after legal review, by the Director of the Office of Legislative Legal Services or the Director's designee.

I. Exhibits.

"Exhibits" means the following Exhibits that are attached to and incorporated by reference into this Contract: Exhibit A (Statement of Work), Exhibit B (Request for Proposal), Exhibit C (Modifications to Contractor’s Proposal), Exhibit D (Contractor’s Proposal), Exhibit E (Information Security Policy for Contractors), Exhibit F (Compensation and Procedures for Billing), Exhibit G (Developing and Presenting Audit Findings), Exhibit H (Reporting Requirements and Format for Separately Issued Report), and Exhibit I (Reporting for Statewide Financial Statements and Single Audit).

J. Incident "Incident" means any accidental or deliberate event that results in or constitutes an imminent threat of the unauthorized access, loss, disclosure, modification, disruption, or destruction of any communications or information resources of the State, which are included as part of the Work, as described in §§24-37.5-401, et. seq., C.R.S. Incidents include, without limitation,

(i) successful attempts to gain unauthorized access to a State system or State Confidential Information regardless of where such information is located; (ii) unwanted disruption or denial of service; (iii) the unauthorized use of a State system for the processing or storage of data; or (iv) changes to State system hardware, firmware, or software characteristics without the State’s knowledge, instruction, or consent.

K. Modifications to Proposal “Modifications to Proposal” means the modifications to Contractor’s Proposal, dated Insert Date if Applicable or Not Applicable.

L. OSA

"OSA" means the Office of the State Auditor.

M. Party or Parties “Party” means the State or Contractor and “Parties” means both the State and Contractor.

N. PCI

"PCI" means payment card information including any data related to credit card holders’ names, credit card numbers, or the other credit card information as may be protected by state or federal law.

O. PHI

"PHI" means any protected health information, including, without limitation, any information, whether oral or recorded in any form or medium that: (i) relates to the past, present or future physical or mental condition of an individual, the provision of health care to an individual, or the past, present or future payment for the provision of health care to an individual; and (ii) either identifies the individual or provides a reasonable basis to believe that it can be used to identify the individual. PHI includes, but is not limited to, any information defined as Individually Identifiable Health Information by the federal Health Insurance Portability and Accountability Act.

P. PII

"PII" means personally identifiable information including, without limitation: (i) any information maintained by the State about an individual that can be used to distinguish or trace the individual‘s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records; and (ii) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information. PII includes, but is not limited to, all information defined as personally identifiable information in §24-72-501, C.R.S.

Q. Proposal “Proposal” means Contractor’s Proposal dated Insert Date.

R. Request for Proposal or RFP “Request for Proposal” or “RFP” means the State’s Request for Proposal, issued Insert Date, including the supplement to the RFP, dated Insert Date.

S. Services “Services” means the required financial and compliance audit services to be performed by

Contractor pursuant to this Contract.

T. State Auditor “State Auditor” means the Colorado State Auditor.

U. State Confidential Information "State Confidential Information" means any and all State Records not subject to disclosure under CORA. State Confidential Information includes, but is not limited to, PII, PHI, PCI, Tax Information, CJI, and State personnel records not subject to disclosure under CORA.

V. State Fiscal Rules "State fiscal rules" means the fiscal rules promulgated by the Colorado State Controller pursuant to §24-30-202(13)(a), C.R.S.

W. State Fiscal Year "State fiscal year" means a 12-month period beginning on July 1 of each calendar year and ending on June 30 of the following calendar year. If a single calendar year follows the term, then it means the State Fiscal Year ending in that calendar year.

X. State Records "State Records" means any and all State data, information, and records, regardless of physical form, including, but not limited to, information subject to disclosure under CORA.

Y. Subcontractor “Subcontractor” means a third-party, if any, engaged by Contractor to aid in performance of its obligations under this Contract.

Z. Statewide Single Audit Report “Statewide Single Audit Report” is the report issued by the OSA and released by the

Legislative Audit Committee that, in accordance with the federal Single Audit Act, includes any findings and recommendations resulting from this audit related to federal awards.

AA. Tax Information "Tax information" means federal and State tax information including, without limitation, federal and State tax returns, return information, and such other tax-related information as may be protected by federal and State law and regulation. Tax Information includes, but is not limited to, all information defined as federal tax information in Internal Revenue Service Publication 1075.

BB. Work “Work” means the tasks and activities that Contractor must perform to fulfill its obligations under this Contract, including the performance of the Services and delivery of the Work Product.

CC. Work Product “Work Product” means the tangible and intangible results of the Work, whether finished or unfinished, including drafts. Work Product includes, but is not limited to, documents, text, software (including source code), research, reports, proposals, specifications, plans, notes, studies, data, images, photographs, negatives, pictures, drawings, designs, models, surveys, maps, materials, ideas, concepts, know-how, and any other results of the Work. This also includes the Audit Report, audit work papers subject to section 18 of this Contract, and any separate report issued as specified in Exhibit H.

DD. Terms Defined in Exhibits Any term used in this Contract that is defined in an Exhibit shall be construed and interpreted as defined in the Exhibit.

5. TERM and EARLY TERMINATION

A. Term-Work Commencement The Parties’ respective performances under this Contract commences on the Effective Date.

This Contract terminates on the earlier of thirty (30) days after the Audit Report has been released by the Legislative Audit Committee or March 31, 2019, unless sooner terminated as specified in this Contract. The State may terminate this Contract for its convenience for any reason, without penalty to the State, upon thirty (30) days prior written notice to Contractor.

B. Early Termination Upon early termination, Contractor shall not incur further obligations or render further performance under this contract past the effective date of the notice of termination and shall terminate any outstanding subcontracts with Subcontractors. Contractor shall deliver to the State all Work, Services, and Work Product to the extent completed as of the termination date. Contractor shall take timely, reasonable, and necessary action to protect and preserve property in the possession of Contractor. Contrctor shall immediately return to the State all materials owned by the State in the possession of Contractor in which the State has an interest. The State shall reimburse Contractor for accepted performance up to the termination date.

6. STATEMENT OF WORK

A. Completion Contractor shall complete the Work on or before October 31, 2018.

B. Services and Work Product Contractor shall provide the Services and deliver the Work Product necessary to complete the Work. Contractor shall accomplish the provision of Services and delivery of Work Product using the Contract Funds only.

C. Employees All persons employed by Contractor or Subcontractors to perform Work under this Contract

Contractor’s or Subcontractors’ personnel for all purposes of this Contract and are not employees of the State for any purpose as a result of this Contract.

7. PAYMENTS TO CONTRACTOR

The State, in accordance with the provisions of this §7, shall pay Contractor in the amounts and using the methods set forth below:

A. Maximum Amount The maximum amount payable under this Contract to Contractor by the State is $XXX,XXX, as determined by the State from available funds. Payments to Contractor are limited to the unpaid obligated balance of the Contract and shall be made as set forth in Exhibit F (Compensation and Procedures for Billing). The estimated amount payable by the State to Contractor during State Fiscal Year 2017-2018 is $XXX,XXX and the estimated amount payable by the State to Contractor during State Fiscal Year 2018-2019 is $XXX,XXX. The exact funding split between the State Fiscal Years, if applicable, will be determined by the State based on amounts that have been budgeted, appropriated, or otherwise made available for this Contract.

B. Payment

i. Interim and Final Payments

Contractor shall initiate any payment requests by submitting invoices to the State in a form approved by the State and in the manner specified in Exhibit F.

ii. Interest The State shall fully pay each invoice within 45 days of its receipt if the amount invoiced represents performance by Contractor previously accepted by the State. Uncontested amounts not paid by the State within 45 days bear interest on the unpaid balance beginning on the 46th day at the rate of one percent per month until paid in full. Interest does not accrue on unpaid amounts that are subject to a good faith dispute between Contractor and the State. Contractor shall invoice the State separately for accrued interest on delinquent amounts, and any such separate billing shall reference the delinquent payment, the number of days' interest to be paid, and the one percent interest rate.

iii. Recovery of Erroneous Payments and Unexpended or Excess Funds At the State’s sole discretion, any payments made to Contractor in error for any reason, including any overpayments or improper payments, and any unexpended or excess funds received by Contractor, may may be collected as a debt due to the State and may be recovered from Contractor by deduction from subsequent payments under this Contract or payments to be made under other contracts, grants, or agreements between the State and Contractor or by other appropriate methods. Contractor shall pay and such overpayments, improper payments, or funds directly to the State.

C. Use of Funds Contract Funds shall be used only for costs identified in this Contract.

8. REPORTING - NOTIFICATION

Reports required under this §8 shall be made in the form and subject to the procedures prescribed by the State.

A. Performance, Progress, Personnel, and Funds Contractor shall comply with all reporting requirements set forth in the Exhibits.

B. Litigation Reporting

After being served in an action before a court or an administrative decision making body with any pleading that is related to this Contract or that may affect Contractor’s ability to perform its obligations under this Contract, Contractor, within ten (10) days after being served, shall notify the State of the action and deliver copies of the pleadings to the State’s principal representative identified in §17 of this Contract. If the State’s principal representative is not then serving, Contractor shall deliver notice and copies to the State Auditor.

C. Noncompliance Contractor’s failure to provide reports, notification of a legal action, or copies of pleadings to the State in a timely manner in accordance with this §8 may result in the delay of payment of funds, termination, or both, as provided under this Contract.

D. Subcontracts Contractor shall submit copies of any and all subcontracts entered into by Contractor to perform its obligations under this Contract to the State or its principal representative upon request by the State.

9. CONTRACTOR RECORDS

A. Maintenance Contractor shall maintain a complete file of all documents, records, communications, notes, and other materials, including but not limited to all Work Product, pertaining in any manner to the Work or the delivery of Services, including Work performed and Services delivered by Subcontractors. Unless Contractor receives written notice of an extension from the State, the federal government, or another duly authorized agent of a governmental agency, Contractor shall maintain the records until the last to occur of: (i) the date five (5) years after the date on which the State accepts the Audit Report or, in the case of early termination, terminates this Contract; (ii) the date on which any pending disputes relating to this Contract are resolved; or (iii) if the performance of this contract is being audited or Contractor receives notice that an audit is pending, the date on which the audit is completed and its findings have been resolved (the “Record Retention Period”).

B. Inspection Contractor, at no additional charge, shall permit the State, any successor auditor, the federal government and any other duly authorized agent of a governmental agency to access and inspect, excerpt, and copy Contractor's work papers and reports related to this Contract during the Record Retention Period to assure compliance with the terms of this Contract, to evaluate performance under this Contract, or for any other purpose required by the State. The State reserves the right to inspect the Work at all reasonable times and places during the term of this Contract, including any extensions or renewals.

C. Monitoring The State, in its discretion, may monitor Contractor's performance of its obligations under this Contract using procedures determined by the State that do not unduly interfere with Contractor's performance of the Work.

10. WORK PRODUCT-CONFIDENTIAL INFORMATION-STATE RECORDS

A. Confidentiality

Contractor shall keep confidential, and cause all Subcontractors to keep confidential, all State Records, unless those State Records are publicly available. Contractor shall not, without prior written approval of the State, use, publish, copy, disclose to any third party, or permit the use by any third party of any State Records, except as otherwise stated in this Contract, permitted by law, approved by the State in accordance with section 2-3-103 (3), C.R.S., or otherwise approved in writing by the State. Contractor shall provide for the security of all State Confidential Information in accordance with all applicable laws, rules, policies, publications, and guidelines including, without limitation: (i) the most recently promulgated IRS Publication 1075 for all Federal Tax Information, (ii) the most recently updated PCI Data Security Standard from the PCI Security Standards Council for all PCI, (iii) the most recently issued version of the U.S. Department of Justice, Federal Bureau of Investigation, Criminal Justice Information Services Security Policy for all CJI, and (iv) the federal Health Insurance Portability and Accountability Act for all PHI and the HIPAA Business Associate Addendum attached to this Contract. Contractor shall immediately forward any request or demand for State Records to the State’s principal representative.

B. Other Entity Access and Nondisclosure Agreements Contractor may provide State Records to its agents, employees, assigns, and Subcontractors as necessary to perform the Work, but shall restrict access to State Confidential Information to those agents, employees, assigns, and Subcontractors who require access to perform their obligations under this Contract. Contractor shall ensure that all such agents, employees, assigns, and Subcontractors sign agreements containing nondisclosure provisions that are at least as protective as those in this Contract, and that the nondisclosure provisions are in force at all times at which the agent, employee, assign, or Subcontractor has access to any State Confidential Information. Contractor shall provide copies of the signed nondisclosure provisions to the State upon execution of the nondisclosure provisions.

C. Use, Security, and Retention Contractor shall use, hold and maintain State Confidential Information in compliance with any and all applicable laws and regulations in facilities located within the United States, and shall maintain a secure environment that ensures confidentiality of all State Confidential Information wherever located. Contractor shall provide the State with access, subject to Contractor’s reasonable security requirements, for purposes of inspecting and monitoring access and use of State Confidential Information and evaluating security control effectiveness. Upon the expiration or termination of this Contract, Contractor shall return State Records provided to Contractor or, except as prohibited by §9 of this Contract, destroy the State Records and certify to the State that it has done so as directed by the State. If law, regulation or any provision of this Contract prevents Contractor from returning or destroying State Confidential Information, Contractor warrants that it will guarantee the confidentiality of, and cease to use, the State Confidential Information.

D. Incident Notice and Remediation If Contractor becomes aware of any Incident, it shall notify the State immediately and cooperate with the State regarding recovery, remediation, and the necessity to involve law enforcement, as determined by the State. Unless Contractor can establish that none of Contractor or any of its agents, employees, assigns or Subcontractors are the cause or source of the Incident, Contractor is responsible for the cost of notifying each person who may have been impacted by the Incident. After an Incident, Contractor shall take steps to reduce the risk of incurring a similar type of Incident in the future as directed by the State, which may include, but is not limited to, developing and implementing a remediation plan approved by the State at no additional cost to the State.

11. CONFLICTS OF INTEREST

A. Actual Conflicts of Interest Contractor shall not engage in any business or activities or maintain any relationships that create a conflict of interest by conflicting in any way with the full performance of Contractor's obligations under this Contract. Such a conflict of interest arises when a Contractor's or Subcontractor's employee, officer, or agent: (i) offers or provides any tangible personal benefit to a State employee, a State employee's partner, or a member of a State employee's immediate family; or (ii) discusses, arrange for, or accepts financial or performance auditing work or non-auditing work not identified in this Contract with the Audited Agency during the term of this Contract without the prior express written approval of the State.

B. Apparent Conflicts of Interest Contractor acknowledges that with respect to this Contract even the apperance of a conflict of interest is harmful to the State's interests. Accordingly, absent the State's prior written approval, Contractor shall refrain from any practices, activities, or relationships that reasonably appear to conflict with Contractor's full performance of its obligations under this Contract. Contractor shall also provide written notice to the State, in accordance with §17 of this Contract, and obtain the State's prior written approval, before entering into a contract or engagement with another State agency, department or division that is subject to audit by the State.

C. Disclosure of Conflicts of Interest If a conflict of interest or the appearance of a conflict of interest arises or if Contractor is uncertain whether a conflict of interest or the appearance of a conflict of interest has arisen, Contractor shall submit to the State a disclosure statement that sets forth the relevant details for the State's consideration. Failure to promptly submit a disclosure statement or to follow the State's direction in regard to the actual or apparent conflict of interest is a breach of this Contract. Contractor shall also comply with Government Auditing Standards with respect to any conflicts of interest arising from the performance of this Contract.

12. REPRESENTATIONS AND WARRANTIES

Each Party has relied on the representations and warranties of the other Party set forth below in entering into this Contract.

A. Qualifications, Standards and Manner of Performance

Contractor represents that it is qualified under applicable law and warrants that it is licensed to perform the Work and Services and deliver the Work Product. Contractor shall perform its obligations under this Contract in accordance with: (i) generally accepted auditing standards as promulgated by the American Institute of Certified Public Accountants in Statements on Auditing Standards; (ii) the standards for financial and compliance audits contained in Government Auditing Standards issued by the Comptroller General of the United States; (iii) the federal Single Audit Act; and (iv) the provisions of Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards.

B. Legal Authority – Contractor Signatory Contractor warrants that it possesses the legal authority to enter into this Contract and that it has taken actions required by its procedures, by-laws, and applicable laws to exercise that authority and to lawfully authorize its undersigned signatory to execute this Contract, or any part of this Contract, and to bind Contractor to its terms. If requested by the State, Contractor shall provide the State with proof of Contractor’s authority to enter into this Contract within fifteen (15) days of receiving the request.

C. Licenses, Permits, and Other Authorizations Contractor represents and warrants that as of the Effective Date it has, and that at all times during the term of this Contract it will have and maintain, at its sole expense, all licenses, certifications, approvals, insurance, permits, and other authorizations required by law to perform its obligations under this Contract. Contractor warrants that it will maintain all necessary licenses, certifications, approvals, insurance, permits, and other authorizations required to properly perform its obligations under this Contract, without reimbursement by the State or any adjustment in Contract Funds.